@thunderid/node 1.11.0 → 1.12.0

package/dist/ThunderIDNodeClient.d.ts

@@ -1,4 +1,6 @@
-import { BackchannelLogoutResult, EmbeddedSelfFlowRequest, EmbeddedSelfFlowResponse, ExtendedAuthorizeRequestUrlParams, IdToken, ManagedFlowListResponse, ManagedUserListResponse, ManagedUserTypeListResponse, OIDCEndpoints, Storage, ThunderIDJavaScriptClient, TokenExchangeRequestConfig, TokenResponse, User } from '@thunderid/javascript';
+import { DeviceAuthorizationOptions, DeviceAuthorizationPollOptions, DeviceAuthorizationResponse, SwitchOrganizationUnitOptions, BackchannelLogoutResult, EmbeddedSelfFlowRequest, EmbeddedSelfFlowResponse, ExtendedAuthorizeRequestUrlParams, IdToken, ManagedFlowListResponse, ManagedUserListResponse, ManagedUserTypeListResponse, OIDCEndpoints, Storage, ThunderIDJavaScriptClient, TokenExchangeRequestConfig, TokenResponse, User } from '@thunderid/javascript';
+import { AccessAction, AccessActionSearchRequest, AccessEvaluationRequest, AccessEvaluationResponse, AccessEvaluationsRequest } from './models/access-evaluation';
+import AuthURLCallback from './models/AuthURLCallback';
 import { ThunderIDNodeConfig } from './models/config';
 import { ThunderIDNodeManagementClient } from './models/management';
 declare class ThunderIDNodeClient<T extends ThunderIDNodeConfig = ThunderIDNodeConfig> extends ThunderIDJavaScriptClient<T> {
@@ -10,6 +12,69 @@ declare class ThunderIDNodeClient<T extends ThunderIDNodeConfig = ThunderIDNodeC
     getInstanceId(): number;
     signIn(...args: any[]): Promise<TokenResponse>;
     getSignInUrl(requestConfig?: ExtendedAuthorizeRequestUrlParams, userId?: string): Promise<string>;
+    /**
+     * Starts a switch of the session `userId` to the organization unit `organizationUnitId`: builds the
+     * unit's authorization URL (`{baseUrl}/ou/{ouId}/oauth2/authorize`) and hands it to `authURLCallback`
+     * to redirect the user to. The server reuses the SSO session when the user can sign in there, so
+     * normally no credentials are asked. Complete it with `signIn(callback, userId, code, state)` on the
+     * callback: the code is redeemed at the unit's token endpoint and replaces the session's tokens.
+     * Until then, and when the callback carries an error, the previous session stays as it was.
+     *
+     * @throws {ThunderIDAPIError} `switchOrganizationUnit-ValidationError-001` without a unit, a session or
+     *   a callback.
+     */
+    switchOrganizationUnit(organizationUnitId: string, options?: SwitchOrganizationUnitOptions & {
+        authURLCallback?: AuthURLCallback;
+        userId?: string;
+    }): Promise<undefined>;
+    /**
+     * Starts a device authorization request (RFC 8628) for an input-constrained device or a CLI tool. Show
+     * the user `userCode` and `verificationUri`; keep `deviceCode`, a credential, to yourself and pass it
+     * to {@link pollDeviceAuthorization}. It is never logged.
+     */
+    startDeviceAuthorization(options?: DeviceAuthorizationOptions): Promise<DeviceAuthorizationResponse>;
+    /**
+     * Polls the token endpoint with the device code until the user approves, denies, or the code expires,
+     * and stores the tokens for the session `userId` on approval.
+     *
+     * @throws {ThunderIDAPIError} `JS-AUTH_CORE-DEVICE2-HE03` when the server ends the request
+     *   (`access_denied`, `expired_token`), with the OAuth error in `serverError`.
+     */
+    pollDeviceAuthorization(deviceCode: string, interval: number, options?: DeviceAuthorizationPollOptions, userId?: string): Promise<TokenResponse>;
+    /**
+     * Introspects a token (RFC 7662) at the server's introspection endpoint, authenticating as this client.
+     * An inactive token is a result (`{active: false}`), not an error.
+     */
+    introspectToken(token: string, tokenTypeHint?: string): Promise<Record<string, unknown> & {
+        active: boolean;
+    }>;
+    /**
+     * The request configuration for access evaluation: the configured server, secret and overrides, with
+     * a per-call secret taking precedence.
+     */
+    private accessEvaluationConfig;
+    /**
+     * Asks the server whether a subject may perform an action on a resource (AuthZEN). A denial is a result
+     * (`decision: false`), not an error. Uses `accessEvaluation.secret`, or `options.secret`.
+     */
+    evaluateAccess(request: AccessEvaluationRequest, options?: {
+        secret?: string;
+        signal?: AbortSignal;
+    }): Promise<AccessEvaluationResponse>;
+    /**
+     * Evaluates a batch of access requests and returns one decision per evaluation, in order.
+     */
+    evaluateAccesses(request: AccessEvaluationsRequest, options?: {
+        secret?: string;
+        signal?: AbortSignal;
+    }): Promise<AccessEvaluationResponse[]>;
+    /**
+     * Asks which actions a subject may perform on a resource.
+     */
+    searchActions(request: AccessActionSearchRequest, options?: {
+        secret?: string;
+        signal?: AbortSignal;
+    }): Promise<AccessAction[]>;
     signOut(...args: any[]): Promise<string>;
     /**
      * Handles an OpenID Connect back-channel logout: validates the logout token the server posted,

package/dist/ThunderIDNodeClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ThunderIDNodeClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNodeClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EAExB,iCAAiC,EAIjC,OAAO,EAIP,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,aAAa,EAGb,OAAO,EAEP,yBAAyB,EACzB,0BAA0B,EAE1B,aAAa,EAEb,IAAI,EACL,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAwB,6BAA6B,EAAC,MAAM,qBAAqB,CAAC;AAMzF,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,eAAe,CAAK;IAG5B,OAAO,CAAC,oBAAoB,CAAkD;IAG9E,OAAO,CAAC,kBAAkB,CAGtB;gBAEe,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhE,aAAa,IAAI,MAAM;IAIjB,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAwE9C,YAAY,CAChC,aAAa,CAAC,EAAE,iCAAiC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAcI,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAe9D;;;;;;;;;;;;;OAaG;IACU,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsD3F;;;;;OAKG;YACW,aAAa;IAYX,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;cAI7B,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E;;;OAGG;YACW,YAAY;YAYZ,kBAAkB;IAgBhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACmB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkC7C,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE;;;OAGG;IACmB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAsBlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAO/D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAI7D,aAAa,CACjC,MAAM,EAAE,0BAA0B,EAClC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAI3C;;;OAGG;IACU,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnG;;;;OAIG;IACU,uBAAuB,CAClC,OAAO,EAAE,uBAAuB,EAChC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,CAAC;IAapC;;;OAGG;YACW,uBAAuB;IAerC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,6BAA6B;IAMpE;;;;OAIG;YACW,8BAA8B;IAyB5C;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACtF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACxF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,YAAY,CACvB,OAAO,GAAE;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACrE,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,2BAA2B,CAAC;CAGxC;AAED,eAAe,mBAAmB,CAAC"}
+{"version":3,"file":"ThunderIDNodeClient.d.ts","sourceRoot":"","sources":["../src/ThunderIDNodeClient.ts"],"names":[],"mappings":"AAGA,OAAO,EAGL,0BAA0B,EAC1B,8BAA8B,EAC9B,2BAA2B,EAE3B,6BAA6B,EAE7B,uBAAuB,EACvB,uBAAuB,EACvB,wBAAwB,EAExB,iCAAiC,EAIjC,OAAO,EAIP,uBAAuB,EACvB,uBAAuB,EACvB,2BAA2B,EAC3B,aAAa,EAGb,OAAO,EAEP,yBAAyB,EACzB,0BAA0B,EAE1B,aAAa,EAEb,IAAI,EACL,MAAM,uBAAuB,CAAC;AAI/B,OAAO,EACL,YAAY,EACZ,yBAAyB,EACzB,uBAAuB,EAEvB,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,4BAA4B,CAAC;AACpC,OAAO,eAAe,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAC,mBAAmB,EAAC,MAAM,iBAAiB,CAAC;AACpD,OAAO,EAAwB,6BAA6B,EAAC,MAAM,qBAAqB,CAAC;AAMzF,cAAM,mBAAmB,CAAC,CAAC,SAAS,mBAAmB,GAAG,mBAAmB,CAAE,SAAQ,yBAAyB,CAAC,CAAC,CAAC;IACjH,OAAO,CAAC,eAAe,CAAK;IAG5B,OAAO,CAAC,oBAAoB,CAAkD;IAG9E,OAAO,CAAC,kBAAkB,CAGtB;gBAEe,UAAU,SAAI;IAKX,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAMhE,aAAa,IAAI,MAAM;IAIjB,MAAM,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IA8E9C,YAAY,CAChC,aAAa,CAAC,EAAE,iCAAiC,EACjD,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,CAAC;IAclB;;;;;;;;;;OAUG;IACmB,sBAAsB,CAC1C,kBAAkB,EAAE,MAAM,EAC1B,OAAO,GAAE,6BAA6B,GAAG;QAAC,eAAe,CAAC,EAAE,eAAe,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAM,GACjG,OAAO,CAAC,SAAS,CAAC;IA8BrB;;;;OAIG;IACmB,wBAAwB,CAC5C,OAAO,GAAE,0BAA+B,GACvC,OAAO,CAAC,2BAA2B,CAAC;IAIvC;;;;;;OAMG;IACmB,uBAAuB,CAC3C,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,8BAA8B,EACxC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,CAAC;IAUzB;;;OAGG;IACmB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;QAAC,MAAM,EAAE,OAAO,CAAA;KAAC,CAAC;IAIvD;;;OAGG;YACW,sBAAsB;IAapC;;;OAGG;IACU,cAAc,CACzB,OAAO,EAAE,uBAAuB,EAChC,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,GACpD,OAAO,CAAC,wBAAwB,CAAC;IAIpC;;OAEG;IACU,gBAAgB,CAC3B,OAAO,EAAE,wBAAwB,EACjC,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,GACpD,OAAO,CAAC,wBAAwB,EAAE,CAAC;IAItC;;OAEG;IACU,aAAa,CACxB,OAAO,EAAE,yBAAyB,EAClC,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,GACpD,OAAO,CAAC,YAAY,EAAE,CAAC;IAIJ,OAAO,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC;IAe9D;;;;;;;;;;;;;OAaG;IACU,uBAAuB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsD3F;;;;;OAKG;YACW,aAAa;IAYX,YAAY,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI;cAI7B,iBAAiB,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7E;;;OAGG;YACW,YAAY;YAYZ,kBAAkB;IAgBhC;;;OAGG;IACH,OAAO,CAAC,iBAAiB;IAezB,OAAO,CAAC,eAAe;IAIvB;;;;OAIG;IACmB,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAkC7C,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAalE;;;OAGG;IACmB,kBAAkB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAsBlE,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,OAAO,CAAC;IAO/D,iBAAiB,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAItE,cAAc,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAIhD,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvC,0BAA0B,IAAI,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAI7D,aAAa,CACjC,MAAM,EAAE,0BAA0B,EAClC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,aAAa,GAAG,QAAQ,GAAG,IAAI,CAAC;IAI3C;;;OAGG;IACU,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAcnG;;;;OAIG;IACU,uBAAuB,CAClC,OAAO,EAAE,uBAAuB,EAChC,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,wBAAwB,CAAC;IAapC;;;OAGG;YACW,uBAAuB;IAerC;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;IACI,UAAU,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,6BAA6B;IAMpE;;;;OAIG;YACW,8BAA8B;IAyB5C;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACtF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,QAAQ,CACnB,OAAO,GAAE;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACxF,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,uBAAuB,CAAC;IAInC;;;;OAIG;IACU,YAAY,CACvB,OAAO,GAAE;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAM,EACrE,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,2BAA2B,CAAC;CAGxC;AAED,eAAe,mBAAmB,CAAC"}

package/dist/api/access/evaluateAccess.d.ts

@@ -0,0 +1,22 @@
+import { AccessEvaluationRequest, AccessEvaluationRequestConfig, AccessEvaluationResponse } from '../../models/access-evaluation';
+/**
+ * Asks the server's AuthZEN policy decision point whether a subject may perform an action on a resource,
+ * at the `access_evaluation_endpoint` from `/.well-known/authzen-configuration`.
+ *
+ * Server-side only: it is authorized by the server-level secret in the `Direct-Auth-Secret` header,
+ * which a browser or mobile app cannot hold.
+ *
+ * A denial is a result: `{decision: false}`, with the reason in `context`. Only a transport failure or a
+ * 4xx/5xx answer throws.
+ *
+ * @example
+ * ```typescript
+ * const {decision} = await evaluateAccess(
+ *   {subject: {type: 'user', id: userId}, resource: {type: 'https://api.example.com/booking'}, action: {name: 'booking:read'}},
+ *   {baseUrl: 'https://localhost:8090', secret: process.env.THUNDERID_DIRECT_AUTH_SECRET!},
+ * );
+ * ```
+ */
+declare const evaluateAccess: (request: AccessEvaluationRequest, config: AccessEvaluationRequestConfig) => Promise<AccessEvaluationResponse>;
+export default evaluateAccess;
+//# sourceMappingURL=evaluateAccess.d.ts.map

package/dist/api/access/evaluateAccess.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluateAccess.d.ts","sourceRoot":"","sources":["../../../src/api/access/evaluateAccess.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,uBAAuB,EACvB,6BAA6B,EAC7B,wBAAwB,EACzB,MAAM,gCAAgC,CAAC;AAExC;;;;;;;;;;;;;;;;;GAiBG;AACH,QAAA,MAAM,cAAc,GAClB,SAAS,uBAAuB,EAChC,QAAQ,6BAA6B,KACpC,OAAO,CAAC,wBAAwB,CAC0D,CAAC;AAE9F,eAAe,cAAc,CAAC"}

package/dist/api/access/evaluateAccesses.d.ts

@@ -0,0 +1,10 @@
+import { AccessEvaluationRequestConfig, AccessEvaluationResponse, AccessEvaluationsRequest } from '../../models/access-evaluation';
+/**
+ * Evaluates a batch of access requests at the `access_evaluations_endpoint`, and returns one decision
+ * per evaluation, in order. `defaults` apply to every evaluation that does not set that member itself.
+ *
+ * Server-side only, like {@link evaluateAccess}. A denial is a result, not an error.
+ */
+declare const evaluateAccesses: ({ defaults, evaluations }: AccessEvaluationsRequest, config: AccessEvaluationRequestConfig) => Promise<AccessEvaluationResponse[]>;
+export default evaluateAccesses;
+//# sourceMappingURL=evaluateAccesses.d.ts.map

package/dist/api/access/evaluateAccesses.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluateAccesses.d.ts","sourceRoot":"","sources":["../../../src/api/access/evaluateAccesses.ts"],"names":[],"mappings":"AAIA,OAAO,EAEL,6BAA6B,EAC7B,wBAAwB,EACxB,wBAAwB,EACzB,MAAM,gCAAgC,CAAC;AAExC;;;;;GAKG;AACH,QAAA,MAAM,gBAAgB,GACpB,2BAAyB,wBAAwB,EACjD,QAAQ,6BAA6B,KACpC,OAAO,CAAC,wBAAwB,EAAE,CASpC,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/api/access/requestAccessApi.d.ts

@@ -0,0 +1,14 @@
+import { AccessEvaluationRequestConfig, AuthZENConfiguration } from '../../models/access-evaluation';
+type AccessEndpointKey = 'evaluation' | 'evaluations' | 'searchAction';
+/**
+ * Reads the AuthZEN metadata of the server at `baseUrl` and checks that its `policy_decision_point`
+ * names that server exactly (apart from a trailing slash).
+ */
+export declare const getAuthZENConfiguration: (operation: string, { baseUrl, fetcher, signal }: Pick<AccessEvaluationRequestConfig, "baseUrl" | "fetcher" | "signal">) => Promise<AuthZENConfiguration>;
+/**
+ * Posts an AuthZEN request with the `Direct-Auth-Secret` header. A `4xx` or `5xx` answer is an error
+ * with the server's `error` as the message; 401, 403 and 404 keep distinct codes.
+ */
+declare const requestAccessApi: <T>(operation: string, key: AccessEndpointKey, config: AccessEvaluationRequestConfig, body: unknown) => Promise<T>;
+export default requestAccessApi;
+//# sourceMappingURL=requestAccessApi.d.ts.map

package/dist/api/access/requestAccessApi.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestAccessApi.d.ts","sourceRoot":"","sources":["../../../src/api/access/requestAccessApi.ts"],"names":[],"mappings":"AAIA,OAAO,EAAC,6BAA6B,EAAE,oBAAoB,EAAC,MAAM,gCAAgC,CAAC;AAEnG,KAAK,iBAAiB,GAAG,YAAY,GAAG,aAAa,GAAG,cAAc,CAAC;AAUvE;;;GAGG;AACH,eAAO,MAAM,uBAAuB,GAClC,WAAW,MAAM,EACjB,8BAA4B,IAAI,CAAC,6BAA6B,EAAE,SAAS,GAAG,SAAS,GAAG,QAAQ,CAAC,KAChG,OAAO,CAAC,oBAAoB,CA6C9B,CAAC;AAuCF;;;GAGG;AACH,QAAA,MAAM,gBAAgB,GAAU,CAAC,EAC/B,WAAW,MAAM,EACjB,KAAK,iBAAiB,EACtB,QAAQ,6BAA6B,EACrC,MAAM,OAAO,KACZ,OAAO,CAAC,CAAC,CAgFX,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/api/access/searchActions.d.ts

@@ -0,0 +1,10 @@
+import { AccessAction, AccessActionSearchRequest, AccessEvaluationRequestConfig } from '../../models/access-evaluation';
+/**
+ * Asks which actions a subject may perform on a resource, at the `search_action_endpoint`
+ * (`/access/v1/search/action`). Server-side only, like {@link evaluateAccess}.
+ *
+ * @returns The actions the subject may perform.
+ */
+declare const searchActions: (request: AccessActionSearchRequest, config: AccessEvaluationRequestConfig) => Promise<AccessAction[]>;
+export default searchActions;
+//# sourceMappingURL=searchActions.d.ts.map

package/dist/api/access/searchActions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"searchActions.d.ts","sourceRoot":"","sources":["../../../src/api/access/searchActions.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,YAAY,EACZ,yBAAyB,EAEzB,6BAA6B,EAC9B,MAAM,gCAAgC,CAAC;AAExC;;;;;GAKG;AACH,QAAA,MAAM,aAAa,GACjB,SAAS,yBAAyB,EAClC,QAAQ,6BAA6B,KACpC,OAAO,CAAC,YAAY,EAAE,CASxB,CAAC;AAEF,eAAe,aAAa,CAAC"}